The questions your IG lead will ask

Assurance and procurement

What your assurance process will ask for

Because the tools transfer no data, connect to no service and are not used at the point of care, a great deal of the standard assurance burden does not apply. Set out here so your team has the answers up front rather than mid-procurement.

The architecture, stated once

Each tool is a single HTML file. You open it in a standard web browser. It installs nothing, creates no account, stores nothing on a server and makes no connection to any outside service, including no connection back to Turning Over. Whatever you load into it is processed in the browser on your own machine and stays there. Close the tab and it is gone unless you saved it yourself.

Most assurance questions are really one question: who else can see this? For a tool of this shape the answer is nobody, because there is no route by which anything could reach anyone.

DTAC

The Digital Technology Assessment Criteria is NHS England's baseline assurance framework, and version 2 replaced the earlier version from 6 April 2026. It covers clinical safety, data protection, technical security, interoperability, and usability and accessibility. It is not statutory, but many NHS buyers treat it as a threshold.

Much of it turns on questions that a locally-run file answers by construction: there is no hosting environment, no data in transit, no user account system, no third-party processor and no integration surface. What remains is documentation rather than engineering. Turning Over Ltd has not completed a DTAC submission. If your organisation requires one for a particular tool, say so when you enquire.

Data protection and DPIAs

A Data Protection Impact Assessment is your organisation's document about your own deployment, not a certificate a supplier hands over. Because the processing happens entirely within your own environment and Turning Over receives nothing, the assessment is about how your team handles the data it already holds. Turning Over does not currently offer a template DPIA. The technical detail your assessment needs (what the file does, what it reads, where its output goes) is set out here and can be provided in writing.

Note that this site itself collects only what you type into the enquiry form. The privacy notice covers that in full.

Clinical safety

DCB0129 and DCB0160 apply to health IT used in the delivery of patient care. These tools support the administration, reporting and governance of a review process concerning deaths that have already occurred. They are not used at the point of care, hold no live patient record, and make no recommendation about any individual's treatment. Mike Leaf has confirmed that no tool is used, or designed to be used, to inform a decision about a living person, so the clinical safety standards do not apply.

Accessibility

Public sector bodies deploying a tool inherit accessibility duties, so buyers reasonably push WCAG 2.2 AA conformance back to the supplier, and DTAC V2 expects it to be backed by testing evidence. This applies to the tools themselves as well as to this website; the accessibility statement covers the site.

The tools have not yet been tested against WCAG 2.2 AA as a whole. Colour contrast in the Self Assessment and Audit Tool has been measured in a browser and meets the standard, text is never smaller than 12 pixels, and a larger-text option is provided. Keyboard use, screen reader support and zoom have not yet been tested, and an accessibility statement for each tool will be published once they have. If your organisation needs that before it can buy, say so when you enquire.

Cyber Essentials, DSPT and security questionnaires

These frameworks assess the systems that hold and move data. A file that holds nothing and moves nothing has a short answer to most of a security questionnaire, and the honest answer to several sections is that they do not apply. Turning Over Ltd does not currently hold Cyber Essentials certification or a completed Data Security and Protection Toolkit return. Where a buyer's process requires a specific certification rather than an explanation, say so at the enquiry stage.